When enabling Security Hub via the API both CIS and Foundational Security Best Practices are now enabled by default. If you want to disable the Foundational Security Best Practices standard you can use the disablesecurityhub.py script in this repo with the '--disable_standards_only' option to disable that standard.

Also if you use AWS Organizations you might want to leverage the delegated administrator feature to enable Security Hub on all accounts, and any new accounts with the auto-enable feature. https://docs.aws.amazon.com/securityhub/latest/userguide/designate-orgs-admin-account.html

ok, Thank you Ryan. I really found this asset very useful.

It would have been great if we could just enable CIS best practices without the "Foundational Security Best Practices " using the enablesecurityhub.py. As a workaround we will run the disablesecurityhub.py as you suggested.

I will explore the delegated administrator feature to enable Security Hub.

thank you

I upvote on this. there is no point in enabling the Foundational Security Best Practices when using the enablesecurity.py script